[SOLVED] No access to MCC from GUI - polkit update to 0.113

[DeMus]

Hi, I have just installed Mageia5 and got the same problem as is mentioned in this thread. Although the solution also worked for me and I can do again what I want/need to do, I find it strange that after almost 2 months there is no cure for the problem yet. I mean, the thread was opened on July 6 and it is almost September 6.
Anyway, it works again and I hope it keeps working. Thanks for the help.

[tomane]

Thanks for your answer.
Well, I have two PCs and they both have the same problem, given solution (restart polkit or computer) doesn't work for me. These two PCs have been upgraded from mageia 4 to 5.
Yes, you're right, the thread has been opened a long time now and this is not solved and no solution for people like me when restarted didn't work.
I posted a solution that is a bit like bypassing polkit, but works, and I was almost insulted by some well-intentioned guys here and in bugzilla.
The truth is one of my PCs is a laptop, and polkit is involved in a lot of things in a laptop : suspend, hibernate, even changing the screen brightness requires polkit.
So I had to add rules to polkit just to allow users to suspend system and change brightness.
I would post them here if someone is interested.

[DeMus]

Tomane,
Of course you should post them here. There are always people who benefit from your experiences. Never mind the few who don't agree with what you came up with, ignore them.
Just post your solution, others will be very thankful.

[tomane]

Just post your solution, others will be very thankful.

You're certainly right. Sorry for replying late.

According to polkit documentation, rules can be added in /etc/polkit-1/rules.d and /usr/share/polkit-1/rules.d directories.
I added my rules in directory /usr/share/polkit-1/rules.d/
There is already a file named 50-default.rules,
The following first file I named 51-suspend.rules is to allow suspend to all users :

Code: Select all

// allow suspend for all users
polkit.addRule(function(action, subject) {
   if ((action.id == "org.freedesktop.login1.suspend")) {
      return polkit.Result.YES;
   }
});
polkit.addRule(function(action, subject) {
   if ((action.id == "org.freedesktop.login1.suspend-multiple-sessions")) {
      return polkit.Result.YES;
   }
});



This second file 52-brightness.rules allows changing brighness for my laptop, using Fn keys.

Code: Select all

// allow changing brighness for all users
polkit.addRule(function(action, subject) {
   if ((action.id == "org.kde.powerdevil.backlighthelper.brightness")) {
      return polkit.Result.YES;
   }
});
polkit.addRule(function(action, subject) {
   if ((action.id == "org.kde.powerdevil.backlighthelper.setbrightness")) {
      return polkit.Result.YES;
   }
});


After adding these rules, I rebooted my laptop just to make sure, but actually according to documentation polkit is supposed to monitor the rules directories and process any changes in real time.
Some other rules can also be added using draksec, but not all.
I found the rules to be added when I looked at /usr/share/polkit-1/actions dir. All actions are listed, you need just to find the right one to set the rule to enable it.

[doktor5000]

According to polkit documentation, rules can be added in /etc/polkit-1/rules.d and /usr/share/polkit-1/rules.d directories.
I added my rules in directory /usr/share/polkit-1/rules.d/

Hi,

custom rules should only be added in /etc/polkit-1/rules.d as that way you ensure that they are not touched by upgrades,
and they overwrite the same rules that might exist under /usr/share/polkit-1/rules.d - this is the same principle as with udev or systemd.

[tomane]

custom rules should only be added in /etc/polkit-1/rules.d as that way you ensure that they are not touched by upgrades,

Good to know it, hopefully I'll not need the rules I added anymore after polkit upgrade !

[doktor5000]

Well, you probably will. FWIW, you might want to see https://wiki.mageia.org/en/Useful_polkit_policies

[tomane]

Well, you probably will. FWIW, you might want to see https://wiki.mageia.org/en/Useful_polkit_policies

This page only tells how to define rules. It's true that I have also a problem when mounting usb keys : I also need to enter a password, that was not the case before.
I'm not sure you understand well what polkit does : polkit allows a regular user to change system settings (that can be very basic like mounting usb keys or changing brightness) that normally (ie without polkit) require to be logged as root, either by asking root password, asking user password or just without notification, depending on the default rule.
Actually, as I already said, none of the default rules work for me since last update.

I'm using mageia since version 1 and this is the first time I need to add such rules. I even didn't know what polkit was before the last update. On the same laptop, I'm using mageia at least from version 3 if I remember well.
Moreover, just after upgrade from mageia 4 to 5 and before the update, it was ok.
Besides, I don't think it is the normal behaviour to not allow a user to set brightness or not suspend by default on a laptop !
On the other hand, it seems that usually the solution given here works. Maybe there is some kind of incompatibility on my laptop (which is a very common toshiba laptop), or there was a problem during the upgrade. Since it's like nobody has had a look at the bug reported, difficult to know.
At the moment, I'm hesitating between continuing like that or reinstalling completely mageia 5.
I don't think just reinstalling polkit is possible, if you know a way to do that, please tell me.

[doktor5000]

I'm not sure you understand well what polkit does : polkit allows a regular user to change system settings (that can be very basic like mounting usb keys or changing brightness) that normally (ie without polkit) require to be logged as root, either by asking root password, asking user password or just without notification, depending on the default rule.

I understand pretty well what polkit does, I tried to explain it to you one page earlier in this thread.

Actually, as I already said, none of the default rules work for me since last update.

That wasn't that clear from your explanation, sorry. And that would be a bug.

At the moment, I'm hesitating between continuing like that or reinstalling completely mageia 5.
I don't think just reinstalling polkit is possible, if you know a way to do that, please tell me.

This should do it:

Code: Select all

urpmi --replacepkgs --replacefiles $(rpm -qa | grep polkit)

[doktor5000]

For everybody that is still affected by polkit issues, please at least provide the following information:

• how do you start your X session
• how do you login to your X session, and is this your first login on this boot or did you logout/login before on this boot?
• output of the following commands run as your regular user:

Code: Select all

cat /run/systemd/users/$(id -u)
ps -ef|grep -v grep|grep -iE "polkit|policykit"

and as root

Code: Select all

systemctl status polkit.service -a


Seems there are two general polkit issues:

1. polkit system service does not restart after installing polkit updates - this should be rarely encountered, maybe for Mageia 5 fresh installations without update. The update was released beginning of July, see the first post in this thread for more details. If you're affected by this issue, either run systemctl restart polkit.service or reboot your box and you are done with that issue, it will not come back until the next polkit update
   
   
2. polkit does not recognise your session as "active" - covered via https://bugs.mageia.org/show_bug.cgi?id=16396
   In the second case you can try the update candidate packages provided by yours truly - see https://bugs.mageia.org/show_bug.cgi?id=16396#c14
   Second case can be easily diagnosed by running grep -i state /run/systemd/users/$(id -u) and when state returns online, then you are affected.
   If it reads active, then everything is normal and you have a different problem if polkit is not working for you as it should, and the first sentence in this post applies.

[banjo]

I just installed Mageia 5 from the Classic DVD - 64 bit, and I am seeing all of these issues intermittently. I have tried the suggestions in this thread, but nothing has worked. I am running in a KDE environment. Other than installing the normal apps I have not done any serious configuring of the system. It is pretty much as it came out of the box.

The symptoms are that clicking on the MCC icon just blinks the icon. The MCC does not run, and there are no error messages posted. Sometimes the updater and/or the MCC will not accept the root password even though I can su root in a command terminal with the same password and that will work.

how do you start your X session

I don't really know. Whatever the normal installation does to start X.

how do you login to your X session, and is this your first login on this boot or did you logout/login before on this boot?

We log in using the graphical front end. This is a multi-user system, so a couple of us log in and out during the day. So this time it happened, there were multiple login/logouts of two or three users before I noticed it. Logging out and logging back in did not fix it.

output of the following commands:

Code: Select all

$ cat /run/systemd/users/$(id -u)
# This is private data. Do not parse.
NAME=brian
STATE=online
RUNTIME=/run/user/1001
SERVICE=user@1001.service
SLICE=user-1001.slice
DISPLAY=c5
REALTIME=1444082187250185
MONOTONIC=40551042148
SESSIONS=c5 c4 c2
SEATS=seat0 seat0 seat0
ACTIVE_SESSIONS=c5
ONLINE_SESSIONS=c5
ACTIVE_SEATS=seat0
ONLINE_SEATS=seat0


Code: Select all

$ ps -ef|grep -v grep|grep polkit
polkitd   2325     1  0 06:41 ?        00:00:00 /usr/lib/polkit-1/polkitd --no-debug
brian    23112     1  0 20:59 ?        00:00:00 /usr/lib64/kde4/libexec/polkit-kde-authentication-agent-1


Code: Select all

$ systemctl status polkit.service -a
● polkit.service - Authorization Manager
   Loaded: loaded (/usr/lib/systemd/system/polkit.service; static)
   Active: active (running) since Mon 2015-10-05 10:41:46 EDT; 10h ago
     Docs: man:polkit(8)
 Main PID: 2325 (polkitd)
   CGroup: /system.slice/polkit.service
           └─2325 /usr/lib/polkit-1/polkitd --no-debug


Code: Select all

$ grep -i state /run/systemd/users/$(id -u)
STATE=online


I have to admit that I don't understand what most of those results mean. What does STATE=online mean in this context?

Any help would be very much appreciated as this is a very annoying bug.

Thanks,
Banjo
(_)=='=~

Update: I just ran the MCC from the command line and it worked, but with some reported errors:

Code: Select all

[root@localhost brian]# drakconf&
[1] 27289
[root@localhost brian]# "/usr/sbin/drakmenustyle" is not executable [Menus] at /usr/libexec/drakconf line 831.
"/usr/sbin/drakbackup" is not executable [Backups] at /usr/libexec/drakconf line 831.
"/usr/sbin/tomoyo-gui" is not executable [Tomoyo Policy] at /usr/libexec/drakconf line 831.
"/usr/sbin/drakguard" is not executable [Parental Controls] at /usr/libexec/drakconf line 831.


The not executable files mentioned in the errors do not exist.

[doktor5000]

Code: Select all

$ grep -i state /run/systemd/users/$(id -u)
STATE=online


I have to admit that I don't understand what most of those results mean. What does STATE=online mean in this context?

From the bugreport linked above:

I was just looking into what this STATE business was all about and found this on the sd_uid_get_state (3) manpage:

• "online" (user logged in, but not active, i.e. has no session in the foreground),
  
• "active" (user logged in, and has at least one active session, i.e. one session in the foreground)

This is because you probably logged in once before and logged out again, and now you current session is incorrectly recognised as "online".
You can try the update candidate posted in the bugreport by me, enable your core_updates_testing repos and install the systemd update.

[tomane]

Same thing for me as Banjo.
State is online.
I don't know what it means, but it's a bit strange.
First I don't understand really why it affects polkit, you would say "never mind" but I personally mind. Second, if it affects polkit, it may also affect other things.
I've had some strange problems with the sound.
And it also, probably, means that the bug is not in polkit.

EDIT: Ok, I just read the comment https://bugs.mageia.org/show_bug.cgi?id=16396#c14
So, nothing related with polkit.
Anyway, maybe I could try the fix on a VB.

Thanks

[banjo]

doktor5000,

OK. Thanks for the help. I did follow the links to the proposed change. One line of code can certainly make a big difference.

I am not at my Linux computer right now so I cannot try the update, but I will give it a try next time I am sitting there.

This bug is not a big deal for me because I have found out how to do what I need from the CLI, and I am the only user on our computer that uses the system tools.

I will try the update later and post my findings on this thread.

Thanks,
Banjo
(_)=='=~

[doktor5000]

Same thing for me as Banjo.
State is online.
I don't know what it means, but it's a bit strange.
First I don't understand really why it affects polkit, you would say "never mind" but I personally mind. Second, if it affects polkit, it may also affect other things.

Well, I explained above what that means, more details are in the bug report. If you would have read the explanation,
you would have seen that only polkit is affected as the newer version checks differently if your session is active or not.

I've had some strange problems with the sound.
And it also, probably, means that the bug is not in polkit.

Your sound issues do not belong in this thread. And it could be totally unrelated to other issues you might have.

EDIT: Ok, I just read the comment https://bugs.mageia.org/show_bug.cgi?id=16396#c14
So, nothing related with polkit.

Nothing related with polkit? The bug only happens because polkit is affected.

[doktor5000]

I mean, if I understand, session status should be active, not online.
If this is corrected, then polkit problem will not occur. Your correction is about systemd something, not polkit.
Am I wrong ?

[banjo]

I see that the proposed fix for bug #16396 (MCC won't start after logging out/in to KDE session - session recognised by polkit as "online" vs. "active") has been pushed out. This morning I have logged in and out and in again, and the MCC came up normally when I tried it.

My session state now shows "active".

Code: Select all

cat /run/systemd/users/$(id -u)
# This is private data. Do not parse.
NAME=brian
STATE=active
RUNTIME=/run/user/1001
SERVICE=user@1001.service
SLICE=user-1001.slice
DISPLAY=c2
REALTIME=1444476838390042
MONOTONIC=23311952
SESSIONS=c2 c1
SEATS=seat0 seat0
ACTIVE_SESSIONS=c2
ONLINE_SESSIONS=c2
ACTIVE_SEATS=seat0
ONLINE_SEATS=seat0


I just mounted a flash drive and there was no request for root password.

The fix is looking good on this end so far.

Thanks for the great support.
Banjo
(_)=='=~

[tomane]

That works for me now.
I removed the rules I added to overcome the bug and it still works, it means that I don't need them anymore.
Thanks for the correction.

[doktor5000]

The other polkit bug, 1. in the list in viewtopic.php?p=59728#p59728
now also has a fix, so those upgrading or installing Mageia 5 will not be affected, polkit system service will be automatically restarted upon an update of the polkit package.

So both major polkit issues are fixed now, and Mageia 4 users are urged to upgrade to Mageia 5, as it's already EOL.

[DiBosco]

I have just started experiencing this problem on my laptop. I cannot run MCC at all any more. I can run drakconf and drakxconf from the command line and get a text based menu but can't actually enter any of the menus that are listed!

systemctl restart polkit

Does nothing.

Has this fault come back, have been lucky up til now or is there a new problem altogether. This thread seems to indicate that the issue has been solved, but "systemctl restart polkit" doesn't help! Am I missing something?

Thanks!

I'm running M5 64 Bit BTW.

[doktor5000]

Am I missing something?

Yes, essential information. See viewtopic.php?p=59728#p59728

[DiBosco]

Am I missing something?

Yes, essential information. See viewtopic.php?p=59728#p59728

I tried that last night. When I click the link it says:

"You are not authorised to read this forum."

[doktor5000]

Happens because this thread was a global announcement, which changes the link depending from which forum you are viewing it. Changed it back to a normal topic now, try again.

Anyways, it's just a dozen posts further up, and linked also in bold red big letters in the initial post of this thread.

[DiBosco]

Happens because this thread was a global announcement, which changes the link depending from which forum you are viewing it. Changed it back to a normal topic now, try again.

Anyways, it's just a dozen posts further up, and linked also in bold red big letters in the initial post of this thread.

OK, sorry if I'm being slow or dumb, but I followed those links at the top of the thread last night and couldn't see any fix there. I'm clearly missing something important, but maybe I've just stared at this too long.

Code: Select all

grep -i state /run/systemd/users/$(id -u)
STATE=active


Code: Select all

cat /run/systemd/users/$(id -u)

# This is private data. Do not parse.
NAME=robertw
STATE=active
RUNTIME=/run/user/500
SERVICE=user@500.service
SLICE=user-500.slice
DISPLAY=c2
REALTIME=1452534880026436
MONOTONIC=52987573
SESSIONS=c2 c1
SEATS=seat0 seat0
ACTIVE_SESSIONS=c2
ONLINE_SESSIONS=c2
ACTIVE_SEATS=seat0
ONLINE_SEATS=seat0
[robertw@linux ~]$

Code: Select all

ps -ef|grep -v grep|grep -iE "polkit|policykit"
robertw   9879     1  0 18:17 ?        00:00:00 /usr/lib64/kde4/libexec/polkit-kde-authentication-agent-1
polkitd  10857     1  0 18:25 ?        00:00:00 /usr/lib/polkit-1/polkitd --no-debug


Code: Select all

systemctl status polkit.service -a
● polkit.service - Authorization Manager
   Loaded: loaded (/usr/lib/systemd/system/polkit.service; static)
   Active: active (running) since Mon 2016-01-11 18:25:15 GMT; 10min ago
     Docs: man:polkit(8)
 Main PID: 10857 (polkitd)
   CGroup: /system.slice/polkit.service
           └─10857 /usr/lib/polkit-1/polkitd --no-debug

Jan 11 18:25:15 linux.local polkitd[10857]: Started polkitd version 0.113
Jan 11 18:25:15 linux.local polkitd[10857]: Loading rules from directory /etc/polkit-1/rules.d
Jan 11 18:25:15 linux.local polkitd[10857]: Loading rules from directory /usr/share/polkit-1/rules.d
Jan 11 18:25:15 linux.local polkitd[10857]: Finished loading, compiling and executing 3 rules
Jan 11 18:25:15 linux.local polkitd[10857]: Acquired the name org.freedesktop.PolicyKit1 on the system bus
Jan 11 18:25:15 linux.local polkitd[10857]: Registered Authentication Agent for unix-session:c2 (system bus name :1.134 [/usr/lib64/kde4/libexec/polkit-kde-authentication-agent-1], object path /org/kde/PolicyKit1/AuthenticationAgent, locale en_GB.UTF-8)
Jan 11 18:25:26 linux.local polkitd[10857]: Operator of unix-session:c2 successfully authenticated as unix-user:root to gain TEMPORARY authorization for action org.mageia.drakconf.pkexec.run for unix-process:10882:189580 [/usr/bin/perl /usr/bin/drakconf] (owned by unix-user:robertw)
[root@linux robertw]#

As far as I can make out I've tried all those other suggestions such as replacing these polkit files, but nothing seems to work.

Thanks!

[doktor5000]

OK, sorry if I'm being slow or dumb, but I followed those links at the top of the thread last night and couldn't see any fix there. I'm clearly missing something important, but maybe I've just stared at this too long.

Yes, that post does not contain a fix as there's nothing to be fixed. The issues that were reported last year were fixed via updates. The post only mentions the minimum amount of information that is required to begin to troubleshoot other polkit issues, whatever the cause may be.

In your case, your user session is considered active, KDE polkit agent is running, the polkit system daemon is running.
And you were able to start drakconf after successful polkit authentication, so polkit doesn't seem to be the problem.

Please also show the output if you run the following command in a normal terminal in your KDE session as your regular user and mention if you see the polkit agent dialog

Code: Select all

pkexec whoami

(you need to enter your root password in the polkit agent dialog)